Securing evidence in a forensic investigation...

When hard drives are seized in a forensic investigation, they have to be copied and an image has to be made as quickly as possible. That’s where the DiscoverX-HD comes in, the ZiuZ appliance that can copy more than one hard drive simultaneously. It’s important that the DiscoverX-HD makes exact images of the hard drives, as we are, after all, talking about evidence in a forensic investigation. And to prove that the images the DiscoverX-HD makes are forensic copies, ZiuZ has conducted various tests. A total of 36 damaged and undamaged hard drives were investigated by one of ZiuZ Forensics' employees.

In a forensic investigation a digital fingerprint is made of the source material before the hard drive is copied. Once copying is complete, a digital fingerprint is made of the copy. It’s essential that the digital fingerprint of the source material matches that of the copy as only then can it be deemed as evidence that can be upheld in a courtroom. This means the DiscoverX-HD must not be able to write to the drive – and this has been tested thoroughly. The first phase of the testing involved a control test to check that the DiscoverX-HD performed properly. The second phase, a flow test, provided an indication of the state of the hard drives. Finally, three further tests were undertaken, two using EnCase and one using the DiscoverX-HD.

A total of 36 hard drives, both damaged and undamaged, were meticulously tested, and the results showed that the DiscoverX-HD performs correctly in a forensic investigation.